Defra Information Management Assessment (IMA) Action plan

1. Defra to bring information and records management practice within scope of KIM vision statements and establish a plan to develop and maintain the right information management culture. Active and visible support of senior management is needed to promote change.

Commentary on progress against main recommendation heading: KIM has opportunities to raise the profile, awareness and need for better records and information management, by a) becoming better embedded in DDTS, b) key contributor to the change management programme for O365, c) ensuring KIM principles are part of the O365 design and architecture, d) ensuring the training for O365 reflects how we can help the business to manage its information more efficiently e) briefing the O365 Senior Champion.

Commentary last updated: July 2018

| Enabling/supporting actions recommended by TNA | Owner | Commentary on progress | Completion due | Status | |-----------------------------------------------|-------|------------------------|----------------|--------| | Formally appointing a senior champion for information and records management to sponsor key communications and campaigns and provide visible leadership, including leading by example. | Head of KIM | The Chief Operating Officer and Director General for Defra Operations now has the role of senior champion. She has already taken the lead in personally launching the smarter ways of working programme, that includes KIM, creating a platform to enable a culture that’s open and collaborative, where people work together. | On going | Ongoing | | Ensuring KIM vision statements are built into DDTS planning and formally aligned to Defra Group strategic objectives. The relationship between KIM visions and the Office 365 adoption strategy vision should be clarified. | Head of KIM | Initially, will involve working with key O365 partners, ensuring KIM messages are embedded in system design, strategy & comms. The second strand will be to ensure the KIM vision to form part of the wider DDTS strategy | Prior to roll-out of O365 | Ongoing | | Factoring information and records management into Director’s assurance statements as done by departments in the IMA programme including the Foreign and Commonwealth Office. | DRO | To liaise with owner of assurance statements & ensure records management is more clearly embedded | July | | | Updating the annual personal commitment statement to provide more effective coverage for information management. | DDTS Security Manager | IT Security are responsible – to discuss key IM messages that will make a difference | July | | Defra Information Management Assessment (IMA) Action plan

2. Defra to deliver greater support and challenge to IAOs, ensuring key threats are surfaced consistently. This report places particular emphasis on those related to lifecycle management and digital continuity.

Commentary on progress against main recommendation heading: The Information Asset Owner network is owned by and managed by IT Security; KIM can work in partnership with IT Security to review messaging, training and a more structured approach to recording and managing information risks.

Commentary last updated: July 2018

| Enabling/supporting actions recommended by TNA | Owner | Commentary on progress | Completion due | Status | |-----------------------------------------------|-------|------------------------|----------------|--------| | Ensuring a central steer is provided to new IAOs on the requirements of the role and establishing Defra specific guidance. This should include adapting the IAO Handbook, following the example of IMA programme members such as the Ministry of Justice. | DDTS Security Manager | KIM to liaise with IT Security | August | | | Engaging with the KIM team to identify what lifecycle and digital continuity related factors should be captured on the Information Asset Register. | DDTS Security Manager/ Head of Information Appraisal | IT Security to liaise with Information Appraisal | July | | | Drawing on models used by other IMA programme members such as the Department for Transport and Department for Education to enable a more structured approach to IAO reporting and risk assessment. | DDTS Security Manager | IT Security to carry out out benchmarking exercise with DoT & DoE. | To be agreed | | Defra Information Management Assessment (IMA) Action plan

3 Defra to identify digital continuity priorities to ensure the usability of digital information and embed these in KIM planning.

Commentary on progress against main recommendation heading: Defra has used TNA’s DROID tool to analyse information held on file shares and information/formats at particular risk. This approach has not been extended to datasets where additional analysis may be necessary. O365 will present new challenges; information formats will be continually updated, but in turn this may result in the loss of formatting and authenticity.

Commentary last updated: July 2018

| Enabling/supporting actions recommended by TNA | Owner | Commentary on progress | Completion due | Status | |-----------------------------------------------|-------|------------------------|----------------|--------| | Factoring consideration of information and records management and digital continuity into IT procurement. | DRO | DRO to liaise with DDTS Engagement Team & ensure that continuity of information is included in new business systems. DRO has also engaged with the Defra Data team and discussions are in progress regarding management and retention. | September 2018 | In progress | | Promoting use of the IMA programme’s Self-Assessment Questionnaire to members of the Defra Group as a means of benchmarking capability. Doing this now will help assess preparedness for migration to Office 365 and identify any digital legacy related risks. | Head of KIM | Perm Sec recognised the value of the self assessment tool. Next step is to check self assessment questionnaire covers the Defra group needs and circulate to Agency/NDPB Chief Executives for completion. | August 2018 | Perm Sec has agreed in March Self Assessment process would add value. | Defra Information Management Assessment (IMA) Action plan

4 Defra to define the risk to the department and wider Defra Group of a failure to manage information and records effectively and a failure to ensure digital information remains usable. Mitigating actions and monitoring mechanisms should be established.

Commentary on progress against main recommendation heading: Information risk is owned by IT Security. It has produced a pan-Defra risk policy but awareness appears to need improvement. KIM can reviewed the risk policy ensuring information risks are better understood and presented in a language more compelling for the end user. Arrangements for reviewing risks will need to reflect whether or not the SIRO role remains.

Commentary last updated: July 2018

| Enabling/supporting actions recommended by TNA | Owner | Commentary on progress | Completion due | Status | |-----------------------------------------------|-------|------------------------|----------------|--------| | Producing a departmental information risk policy that covers information and records management related risk. | DDTS Security Manager | IT Security to update the Information Risk Policy (2016). To ensure it reflects Defra Group plans for information records management. | To be agreed | | | Embedding definitions at a proportionate level within the DDTS risk reporting framework, including mitigating actions. | Head of KIM | KIM will capture the IM related risks it faces and get a consolidated and agreed risk described and logged on risk registers, particularly given the amount of change Defra is going through and the amount of EU Exit related work it is involved in. Defra’s Strategic Risk Guidance and recognising the potential reputational, operational and legal impacts, DDTS is the level at which mitigation is being applied and therefore the right level for ownership and from which the risk may be escalated. | To be agreed | | | Encouraging business areas to define the risks that poor information management practice raise. | Head of KIM | To liaise with Change Management Team for O365 & include messaging on promoting best practice for information management in training given to business teams. | TBC | | Defra Information Management Assessment (IMA) Action plan

5 Defra to maintain the priority currently attached by Office 365 plans to information management and information assurance, ensuring opportunities to strengthen governance and embed good practice are taken.

Commentary on progress against main recommendation heading: Defra has already taken the lead in working with network partners to agree common information policies that will operate in O365. These include improved management of email, a drive to encourage saving evidential information in Sharepoint as a corporate asset, improved collaboration.

Commentary last updated: July 2018

| Enabling/supporting actions recommended by TNA | Owner | Commentary on progress | Completion due | Status | |-----------------------------------------------|-------|------------------------|----------------|--------| | Reviewing Defra’s policy on restricting personal storage and ensuring proportionate enforceable controls are in place now and for potential risk areas such as OneDrive. | KIM Steering Group | A series of KIM policies for O365 has already been agreed by Corporate Services Board (CSB) & will be reviewed annually. Additional changes KIM might want to introduce will also be cleared with CSB. | Completed in Jan 2018 | On-going | | Providing targeted support to staff in addition to this to help drive the right behaviours in key areas such as email management, Vault usage and records capture. Welsh Government’s project to tackle archived emails and improve email management may be helpful. | O365 Adoption Lead | To form part of the training delivered to business teams using O365. Further progress on hold until BAU activity can commence. A policy decision has been taken to discontinue using Vault and IT are considering how best to migrate out legacy Vaulted emails | In progress | The Email migration component is due to be completed this calendar year. | | Ensuring ongoing focus on actions taken by LICs and staff to support effective application and implementation of retention schedules. | O365 Adoption Lead | SharePoint Business Partners (SPBP’s) proactively support the LIC network on roll-out & follow up reviews. Retention standards have been agreed and are applied by SPBP’s to ensure correct application. | Ongoing | | | Reusing work already conducted for the SharePoint 2013 roll-out and learning lessons. | O365 Adoption Lead | Lessons learned from SP13 roll-out are being applied to O365 | Ongoing | |

### Defra Information Management Assessment (IMA) Action plan

| Including KIM membership on DDTS governance boards. | Head of KIM | Already actioned. | Completed | |-----------------------------------------------------|-------------|-------------------|-----------| | Identifying how the implementation and embedding work and delivery of a KIM service will be resourced and supported. This needs to include use of devolved networks, with consideration given to the provision of administrative support as well as active championing of good practice in overall terms. | Head of KIM/ Business Change Lead | KIM to work with Change Management Team to discuss support arrangements for O365 post rollout. | In Progress | Defra Information Management Assessment (IMA) Action plan

6 Defra continue promoting information and records management policy and supporting guidance. This should be reviewed before the introduction of Office 365 to ensure an effective mandate is established for teams and individuals.

Commentary on progress against main recommendation heading: The KIM Defra Group are committed to producing and agreeing common policies and guidance to embed information and records management in our new ways of working with Office 365

Commentary last updated: July 2018

| Enabling/supporting actions recommended by TNA | Owner | Commentary on progress | Completion due | Status | |-----------------------------------------------|-------|------------------------|----------------|--------| | Engagement between HR and KIM to establish a joined up process for coverage of information management during induction. | DRO/ KIM O365 Coordinator | To be discussed with HR | September | | | Publishing What to Keep or other retention guidance publicly, as recommended in Sir Alex Allan’s 2014 Records Review report. | Head of Information Appraisal | To discuss with DDTS Data Sharing Team responsible for publishing on Gov.uk | September | What to Keep Guide currently being updated | | Working with private offices to ensure original ministerial comments are being captured as part of the record. | DRO | DRO to liaise with Secretariat/Private Offices | July | | | Following good practice principles established by the Section 46 Code of Practice such as Board level sign off. Policy should ideally establish the role of individuals, managers and senior staff in making sure information is managed effectively. | DRO | To be considered in consultation with TNA. | | | Defra Information Management Assessment (IMA) Action plan

7 Defra to build on the positive start made through team site reviews and establish a new performance monitoring model that can be developed and embedded over the long term.

Commentary on progress against main recommendation heading: The team site review methodology is now well established, lessons learned and recognised as being helpful to inform directors. It is anticipated that a similar “audit function” will be adopted in the future to ensure continual improvement, however immediately ahead, the rollout of Office 365 will fully occupy existing resources to deliver SharePoint sites and training.

Commentary last updated: July 2018

| Enabling/supporting actions recommended by TNA | Owner | Commentary on progress | Completion due | Status | |-----------------------------------------------|-------|------------------------|----------------|--------| | Drawing on the good practice approach implemented by HM Treasury, which factors in senior accountability and use of statistics. | O365 Adoption Lead | Teamsite reviews completed & methodology established. Review resource likely to be diverted to O365 roll-out. Further progress on hold until BAU activity can commence. | | | | Incorporating qualitative as well as quantitative measures. | O365 Adoption Lead | See above. | | | Defra Information Management Assessment (IMA) Action plan

8. Defra to maintain the priority currently attached to meeting the requirements of the 20-year rule transition period.

Commentary on progress against main recommendation heading: Defra has already produced a five year plan and it aware of peaks and troughs in the appraisal programme and the demands of particular record sets. To assist the appraisal of digital information (due 2021) Defra will continue researching suitable data analytical tools with a view to procurement once existing electronic holdings have been migrated to the cloud.

Commentary last updated: July 2018

| Enabling/supporting actions recommended by TNA | Owner | Commentary on progress | Completion due | Status | |-----------------------------------------------|-------|------------------------|----------------|--------| | Establishing an appraisal report. | Head of Information Appraisal (paper) | Items selected for TNA are entered on an annual spreadsheet (recently revised). Defra will continue to develop a digital appraisal methodology and appraisal plan, the latter to reflect TNA’s best practice model | Completed | Ongoing | | Continuing to engage with The National Archives as it defines a deliverable five-year-plan, ensuring it has capacity to keep pace with the transition to the 20-year rule. | DRO/Head of Information Appraisal | Regular planning meetings with IMC every 2-3 months. Workforce planning to ensure adequate resource to meet Statutory 20 year commitments | Completed | Ongoing | | Defining the risk to Defra’s ability to comply with 20-year requirements if further legacies in all paper or digital format are inherited due to machinery of government changes. | DRO/Head of Information Appraisal | Regular planning meetings with IMC as above. The Records Management risk register to reflect potential challenges of dealing with further inherited records from the one Defra initiative. | Completed | Ongoing | | Identifying how data and use of analytical models can be factored into Defra’s information and records management approach | DRO/Record Manager | Discussions with the Data team will ensure that data and models used to inform policy are identified as in scope for potential selection and transfer. | December | | | Including maintenance of function pages in team site reviews. | O365 Adoption Lead | In the creation of new teamsites for O365, KIM will ensure that function pages are maintained to provide a full history of the site and key records. This will be essential to assist e-Review and appraisal in the future. | Principle has been agreed | On going |